Paper/Archive/CVE-2022-22980

CVE-2022-22980

vmware — A Spring Data MongoDB application is vulnerable to SpEL Injection when using @Query or @Aggregation-annotated query methods with SpEL exp…

EPSS 18%CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (NVD)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 97.2.972 × 2019.4 No public exploit+100.0 SSVC exploitation: unknown+100.0

Description · from the CVE record

A Spring Data MongoDB application is vulnerable to SpEL Injection when using @Query or @Aggregation-annotated query methods with SpEL expressions that contain query parameter placeholders for value binding if the input is not sanitized.

Affected

ProductAffectedFixed inSource

Spring Data MongoDB3.4.0, 3.3.0 to 3.3.4 and Older–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

reftanzu.vmware.com/security/cve-2022-22980